Hit by rogue anti-virus trojan - help needed

[Coherence]

So today I suddenly started getting pop-ups on my laptop in Firefox, despite having pop-up blocking, AdBlockPlus, AVG, etc. (I suspect they were coming either from engadget.com, would surprise the hell out of me that they'd be the source, but the ad pop-ups did stop after closing their page - makes me wonder if they got hacked specifically for the increased traffic they'd get as official blog of CES). I always closed the pop-ups as they appeared, as I know better than to click on pop-up ads, for this very reason.

However, I suddenly found my desktop with "Internet Security 2010" on it, and repeated AVG warnings of infected DLLs. As suspected, this is the latest version of the old "Anti-Virus 200x" rogue software, which is basically an extortion scheme to get you to buy a full version of itself to remove it.

Having warned many co-workers and clients of this virus, I'm extremely embarrassed to have been hit by it. As I've had to recommend to others, I tried running Malwarebytes (combined with rkill.exe), but had tons of problems doing it. Eventually, I was able to do a System Restore (which also would not run until running rkill), and now I seem to be free of the virus (no fake virus infection warnings, and the IS2010 icon is gone from my desktop) after running Malwarebytes in Safe Mode.

The problem I now have is that there may be some remnant of the trojan which is turning off my hard drive after a few minutes when running in Normal mode, keeping me from performing further cleanup, or running just about any apps at all. I tried running another Malwarebytes full scan in Safe Mode again, and it found MANY more infections, but it still did not fix the HD turning off.

Any suggestions? This is a Dell Inspiron 1520, which has a hidden partition containing the original factory image, but I'd like to avoid reimaging the HD (and I'm not even sure that will be possible, since the last scan found "rootkit.mbr", which I understand may affect the master boot record, thereby keeping me from using the built-in imaging utility).

 

[tcsenter]

Open an elevated command prompt. To do this, click Start, click All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator. If you are prompted for an administrator password or for a confirmation, type the password, or click Allow.

Type the following command, and then press ENTER:

sfc /scannow

http://support.microsoft.com/kb/929833


To date, I've seen about a dozen variants of this rouge/fake security software and they are nasty. Even after I'm 100% certain there are no traces of the infection left, in most cases there was enough damage to system environment and/or registry to leave the system in some dysfunctional state or another. Of the few systems that seemed to function OK, I just couldn't be confident enough or bring myself to leave them in an unknown state.

IOW, I've always ended-up performing a repair install (in-place upgrade) or reinstall of the OS and all the apps.

 

[pcgeek11]

Open an elevated command prompt. To do this, click Start, click All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator. If you are prompted for an administrator password or for a confirmation, type the password, or click Allow.

Type the following command, and then press ENTER:

sfc /scannow

http://support.microsoft.com/kb/929833


To date, I've seen about a dozen variants of this rouge/fake security software and they are nasty. Even after I'm 100% certain there are no traces of the infection left, in most cases there was enough damage to system environment and/or registry to leave the system in some dysfunctional state or another. Of the few systems that seemed to function OK, I just couldn't be confident enough or bring myself to leave them in an unknown state.

IOW, I've always ended-up performing a repair install (in-place upgrade) or reinstall of the OS and all the apps.

This is the best answer... Why take a chance.

pcgeek11

 

[Coherence]

Open an elevated command prompt. To do this, click Start, click All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator. If you are prompted for an administrator password or for a confirmation, type the password, or click Allow.

Type the following command, and then press ENTER:

sfc /scannow

http://support.microsoft.com/kb/929833


To date, I've seen about a dozen variants of this rouge/fake security software and they are nasty. Even after I'm 100% certain there are no traces of the infection left, in most cases there was enough damage to system environment and/or registry to leave the system in some dysfunctional state or another. Of the few systems that seemed to function OK, I just couldn't be confident enough or bring myself to leave them in an unknown state.

IOW, I've always ended-up performing a repair install (in-place upgrade) or reinstall of the OS and all the apps.

Thanks, tcsenter, I'll try that. although the KB article you linked is for Vista/7, I found the related article for XP Pro, and it seems to be pretty much identical.

 

[mechBgon]

Here are some more security suggestions you should look at to prevent it happening again: http://www.mechbgon.com/security That list of countermeasures works best when they're all applied together, but at the very least, fully enable your Data Execution Prevention, get the Microsoft Update engine instead of just Windows Update, get the Secunia security checkup utility and use it regularly, and make sure your system's been upgraded with Internet Explorer 8 whether you routinely use IE yourself or not.

A non-Administrator user account is also strongly recommended unless it causes show-stopping problems for you.

 

[Coherence]

Here are some more security suggestions you should look at to prevent it happening again: http://www.mechbgon.com/security That list of countermeasures works best when they're all applied together, but at the very least, fully enable your Data Execution Prevention, get the Microsoft Update engine instead of just Windows Update, get the Secunia security checkup utility and use it regularly, and make sure your system's been upgraded with Internet Explorer 8 whether you routinely use IE yourself or not.

A non-Administrator user account is also strongly recommended unless it causes show-stopping problems for you.

I'll check that out, mech, thanks!

I ended up reimaging the laptop this morning (the system still froze up from the HD locking down, which kept sfc from completing) and spending the entire day (and evening) updating the OS, reinstalling software, drivers, etc. I can't say I really lost anything important, fortunately, so at least this forced me to clean house, so to speak.

 

[Coherence]

ignore

 

[Coherence]

Here are some more security suggestions you should look at to prevent it happening again: http://www.mechbgon.com/security That list of countermeasures works best when they're all applied together, but at the very least, fully enable your Data Execution Prevention, get the Microsoft Update engine instead of just Windows Update, get the Secunia security checkup utility and use it regularly, and make sure your system's been upgraded with Internet Explorer 8 whether you routinely use IE yourself or not.

A non-Administrator user account is also strongly recommended unless it causes show-stopping problems for you.

mechBgon,

Thanks for your previous help. I took many of your suggestions, in particular doing most of my work using a guest account, and using Run As when needed. Unfortunately, I got hit AGAIN on my same laptop by another rogue anti-virus app, WHILE using the guest account. I really don't understand how it managed to install itself, and I watched it happen.

What REALLY pisses me off, is that it came from the #1 search result on Google when looking for a fricking food vacuum sealer review. My search terms were "foodsaver v3840 v3860", first result was a link to retrevo.com, which I clicked (since my AVG plugin said it was a safe link), at which point I noticed an odd "updating" program in my Windows taskbar. (Going back to the same link suddenly forced the page to change to a Canadian Pharmacy site, which set off even louder alarm bells in my head.)

I immediately started running my AVG, to be safe, and suddenly on top of my AVG another Antivirus window appears, and a new icon in my system tray (similar to the last time). It wouldn't let me open TaskManager, saying it was infected. I tried to restart the laptop, but it seemed to hang, so I powered it off.

Now I'm rebooted into my Admin account, running MalwareBytes. I had just done a full scan with it last night, and found no infections. Now it has found 8, so far, as I'm typing this on my other PC while it runs.

I am so livid right now, I'm literally shaking. Hopefully, MalwareBytes will be able to clean it without me having to reimage the laptop a second time in as many months.

I would really like to contact Google and tell them about this infected site they so graciously sent me as the top search result, but I can't find anything on Google to send that kind of feedback. I mean, don't some sites pay Google to be ranked near the top? If that's the case, they paid Google to infect me!

At this point, I'm seriously considering doing all my web browsing in a VM-environment.

 

[SpatiallyAware]

I'm about 99.9% sure you have to actually click on something for these rogue av things to install, can someone confirm?

 

[PeteRoy]

Did you try Microsoft Security Essentials? It's free and it has anti virus plus anti spyware, it might be able to get rid of this thing.

 

[tcsenter]

What REALLY pisses me off, is that it came from the #1 search result on Google when looking for a fricking food vacuum sealer review. My search terms were "foodsaver v3840 v3860", first result was a link to retrevo.com, which I clicked (since my AVG plugin said it was a safe link)...

Either retrevo.com was temporarily compromised or you acquired it elsewhere prior to visiting retrevo.com.

 

[Coherence]

Well, it appears MalwareBytes was able to remove it this time without any problems (unlike the first one I got). I've also reported the search result to Google (though they don't exactly make it easy).

I'll have to check reviews of Microsoft Security Essentials. My company's IT swears by MalwareBytes, so maybe I'll even buy the full version.

 

[Athadeus]

Just curious what browser you were using while visiting that site? I have personally seen Symantec antivirus 10 corporate quarantine a file immediately after clicking a google link in IE (v7?).

I just spent 8 hours last weekend reinstalling windows for someone after my week earlier attempt at removing all the malware failed. It had some trojans and a fake AV, and I found and removed 7 infected files. However, the MBR became corrupted (possibly the malware?) a day later. I did chckdsk /p, fixmbr, and fixboot which got it running again but the performance was still crappy and I wasn't confident the system was clean so I knew it had to be nuked then.

I am a bit paranoid with my personal machines now too since discovering some potential trojans on both my desktop and laptop. I think two on my desktop were falsely identified since the supposedly infected files had been there for years. The laptop infections were legitimate, so I hope AVG found all of them.

 

[Coherence]

Just curious what browser you were using while visiting that site? I have personally seen Symantec antivirus 10 corporate quarantine a file immediately after clicking a google link in IE (v7?).

I just spent 8 hours last weekend reinstalling windows for someone after my week earlier attempt at removing all the malware failed. It had some trojans and a fake AV, and I found and removed 7 infected files. However, the MBR became corrupted (possibly the malware?) a day later. I did chckdsk /p, fixmbr, and fixboot which got it running again but the performance was still crappy and I wasn't confident the system was clean so I knew it had to be nuked then.

I am a bit paranoid with my personal machines now too since discovering some potential trojans on both my desktop and laptop. I think two on my desktop were falsely identified since the supposedly infected files had been there for years. The laptop infections were legitimate, so I hope AVG found all of them.

I was using Firefox 3.6. I suspect the page I accessed used a Flash exploit to infect me with nothing more than an inadvertant mouseover (no actual click on anything).


Edited to add:

Here's an interesting development. My Chrome browser has stopped working since getting this last bug. Looks like I'll have to reinstall it. Any site I try to open gives the following result:

This webpage is not available.

The webpage at http://www.google.com/ might be temporarily down or it may have moved permanently to a new web address.

More information on this error
Below is the original error message

Error 102 (net::ERR_CONNECTION_REFUSED): Unknown error.


Edited AGAIN to add:

Holy crap, it's even affecting IE8! This is on my Guest account, at least. I'll have to test it on my Admin account. For now, only Firefox is working on my Guest account.


ETA: Confirmed it is only affecting my Guest account. IE and Chrome work fine in my Admin account. Perhaps I should just delete that Guest account and create a new one?

 

[dfnkt]

Coherence: If you want to give something a shot you could download and install Windows Steady State and turn on the "Revert changes on reboot" option for your guest account, just a suggestion you might think about.

 

[Coherence]

Coherence: If you want to give something a shot you could download and install Windows Steady State and turn on the "Revert changes on reboot" option for your guest account, just a suggestion you might think about.

I'll look into that, thanks for the tip.

 

[RebateMonger]

A web site doesn't have to be malicious or "hacked" to transmit malware.

Many commercial web sites host advertisements that are fed to them from third-party sites. The ads may show up as changing sidebars or top bars on the web site. If one of those third-party advertisements is contaminated, that advertisement can attempt to transmit malware to your PC.

 

[SirGeeO]

I thought when you get a rootkit, a reinstall is the better option in the 1st place?

Besides that, XSS is a mug. I use BT4, and the exploits available are beyond reasonable comprehension. I use it for my home network troubleshooting and making sure "I" have no intruders, but I mean, you'd be astonished at what's available to take an individuals computer hostage (even if it's not a cracked or botted box).

Hope all goes well for you mate.